Wiki › Techniques, Tactics & Procedures (TTPs) › Initial Access › Drive-By Compromise

Drive-By Compromise

2 min read

Jump to:

Overview

Drive-By Compromise is a technique where adversaries exploit vulnerabilities in websites or web content to deliver malicious payloads to visitors without their knowledge. It typically occurs during the initial access phase of an attack lifecycle, enabling attackers to silently infect systems by leveraging trusted web resources. This method is favored for its stealth and ability to target a broad range of victims through legitimate browsing activity.

Attack Objective

Gain initial access to victim systems by delivering malware or exploit code
Supports the Initial Access and Execution stages of the attack lifecycle
Advances the attacker’s position by establishing a foothold within the target environment through covert infection vectors

How the Technique Works

Adversaries compromise legitimate websites or inject malicious code into web content, which then exploits browser vulnerabilities or plugin flaws when visited by a user. The malicious payload is delivered automatically, often without user interaction beyond visiting the site, leading to execution of attacker-controlled code on the victim’s device. This can result in installation of backdoors, credential theft, or further lateral movement.

Common Methods & Variations

Compromising popular websites to host exploit kits or malicious scripts
Using malvertising campaigns to redirect users to exploit-laden pages
Variants include targeting cloud-hosted web applications or content delivery networks
Employing living-off-the-land techniques by leveraging legitimate browser features and plugins rather than custom malware

Indicators of Compromise (IOCs)

Unusual outbound network connections to known exploit kit domains or IPs
Browser crashes or unexpected behavior during web browsing
Presence of suspicious scripts or iframe injections in web traffic logs
Endpoint alerts for exploitation attempts or execution of unknown processes following web access

Detection Strategies

Monitoring web proxy and DNS logs for access to suspicious or newly registered domains
Behavioral detection focusing on anomalous browser activity and process spawning
Correlation of endpoint telemetry with network events to identify exploitation patterns

Mitigation & Prevention

Regular patching of browsers, plugins, and related software to close known vulnerabilities
Implementing web filtering and reputation-based blocking of malicious sites
Enforcing least privilege and application control policies to limit execution of unauthorized code
User education on risks associated with untrusted web content

Response Considerations

Immediate isolation of affected endpoints to prevent further compromise
Investigation of web access logs and endpoint artifacts to determine scope and entry vector
Removal of malicious payloads and hardening of systems against similar future attacks

Related Techniques

Phishing campaigns used to lure victims to compromised sites
Exploitation of public-facing applications for initial access
Command and Control establishment following successful compromise

Mapping & References

MITRE ATT&CK: Initial Access – Drive-by Compromise (T1189)
Public advisories on exploit kits and malvertising campaigns from cybersecurity organizations
Incident reports detailing large-scale drive-by compromise operations

Tags: Cybersecurity Defense Drive-By Attack endpoint security Execution exploit kits Initial Access Malvertising network security Threat Detection Web Exploitation